CVE-2026-12767 is a server-side request forgery (SSRF) vulnerability in IBM Langflow OSS versions 1.0.0 through 1.11.5. An unauthenticated attacker can exploit this vulnerability to cause the system to send unauthorized requests, potentially enabling network reconnaissance or facilitating further attacks. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges or user interaction, with low complexity and impacts confidentiality and integrity to a limited degree.

The vulnerability allows an unauthenticated attacker to send unauthorized requests from the affected system, which may lead to network enumeration or assist in other attack vectors. The impact is limited to partial confidentiality and integrity loss without availability impact, consistent with a medium severity rating.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor IBM's advisories for updates and consider restricting network access or applying other compensating controls to limit exposure until a fix is available.